External risk intelligence

Twenty SQL Injection via Workspace Administrator Permissions.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-73069

Twenty is a CRM platform typically deployed as a web application. As a CRM, it is frequently exposed to the internet to allow remote access for users and external integrations, making its web-based management and API endpoints commonly reachable in real-world deployments.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in the Twenty open-source CRM platform, affecting previous versions before 2.15.0. This issue allows for the execution of arbitrary commands by an administrator with specific permissions, potentially leading to unauthorized access and modification of the application's database.

Data exposure and command execution risk.
Impacts customer data and system integrity.
Confirm relevance and assess exposure impact.

Attack Path

How an attacker could exploit the issue

An attacker with administrative access to the Twenty CRM can supply malicious input when configuring a system's TS_VECTOR field. This input is then used in constructing a SQL query without proper escaping, allowing the attacker to execute arbitrary PostgreSQL commands as the application's database user.

Requires administrator access.
Supply settings for TS_VECTOR field.
Arbitrary SQL execution.

Live Threat

Current exploitation, exposure, and threat context

A workspace administrator with the DATA_MODEL permission could execute arbitrary PostgreSQL commands by supplying unescaped input through specific API endpoints or GraphQL mutations. This could affect system data and service behavior when supported by the advisory's context.

System data and service integrity at risk.
Arbitrary SQL execution via API or GraphQL.
Unrestricted database access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The critical vulnerability in Twenty's data modeling allows administrators with specific permissions to inject arbitrary SQL, impacting the application's database. This requires immediate attention from teams managing the Twenty application and its underlying database infrastructure. The first practical step is to identify all Twenty instances, confirm their reachability and business criticality, and then coordinate with the application or platform owners to plan remediation, prioritizing instances with wider exposure or higher impact.

Application and platform teams own remediation.
Verify Twenty instances and their reachability.
Plan upgrades and coordinate vendor support.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Twenty platform?

Twenty is an open-source customer relationship management (CRM) platform. It provides organizations with tools to manage business contacts, sales pipelines, and customer data. Because it is a web-based application, it is commonly hosted to facilitate remote team collaboration and integration with other business systems.

How does CVE-2026-73069 create a vulnerability?

This CVE involves a vulnerability classified as CWE-89, commonly known as SQL Injection. It occurs because the software fails to properly sanitize or escape input provided when configuring a specific database field. This flaw allows an attacker to break out of the intended data field and execute their own unauthorized PostgreSQL commands directly against the application database.

Does any administrator action trigger this SQL bug?

No, it is not any administrator action. The vulnerability specifically requires an administrator who possesses the DATA_MODEL permission to interact with the system's TS_VECTOR field. Using other administrative functions or having lower-level user permissions does not trigger this path, as the flaw is tied to the way the software builds SQL definitions during that specific metadata update process.

Is my Twenty instance at risk of this SQL injection?

Halo Surface Signal indicates that Twenty instances are frequently deployed as internet-facing web applications to support remote access and API integrations. If your instance is reachable from the internet, it faces a higher likelihood of being targeted compared to internal-only systems. You should verify your specific deployment's network accessibility to understand your exposure.

What is the first step to remediate CVE-2026-73069?

The primary response is to update your Twenty installation to version 2.15.0 or later, which contains the fix for this issue. Before applying the update, identify all running instances in your environment, assess their business criticality, and coordinate with the relevant platform owners to ensure the upgrade is applied successfully without disrupting your database infrastructure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.